• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>Information, Communication and Automation Technologies, 2009. ICAT 2009 >Trojan detection using MIB-based IDS / IPS system
【24h】

Trojan detection using MIB-based IDS / IPS system

机译：使用基于MIB的IDS / IPS系统进行木马检测

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Identifying and detecting Trojans (malicious software installed and run on a host, without the acquiescence of the host's owner) is a major element in delivering computer security. As with any computer application, installation of a Trojan leaves a ldquofootprintrdquo on the systems resources. However, detection is non-trivial: the detector must be able to recognize the symptoms against a background of a range of other (ldquosaferdquo) activities, which also consume system resources. Furthermore, such detection activity should be at least resource neutral (in other words, the resources consumed by the detection process should not be more than the resources saved in detection). Therefore, we wished to explore the potential of an economical approach that explicitly takes into account resources used. In order to achieve our aim, we explore the possibility of making use of the existing widely deployed management information database (the MIB) as the basis for detecting attempts to install Trojan software on networked systems. We identify the characteristics of typical attacks in respect of the impact they have on particular MIB objects, and propose a decision-tree based algorithm which can detect Trojan activity. We identify the likely effectiveness of this system, with particular reference to the need for such information to be gathered in a timely manner.
机译：识别和检测特洛伊木马（在主机上安装并运行的恶意软件，而无需主机所有者的默认）是提供计算机安全性的主要因素。与任何计算机应用程序一样，木马的安装在系统资源上留下了“足迹”。但是，检测并非易事：检测器必须能够在一系列其他（“安全”）活动的背景下识别症状，这些活动也消耗系统资源。此外，这种检测活动至少应是资源中立的（换句话说，检测过程所消耗的资源不应大于检测中节省的资源）。因此，我们希望探索明确考虑所使用资源的经济方法的潜力。为了实现我们的目标，我们探索了利用现有的广泛部署的管理信息数据库（MIB）作为检测尝试在网络系统上安装Trojan软件的基础的可能性。针对典型攻击对特定MIB对象的影响，我们确定了典型攻击的特征，并提出了一种基于决策树的算法，可以检测特洛伊木马活动。我们确定了该系统的可能有效性，尤其是需要及时收集此类信息。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号